How to stop sending duplicate Slack notifications for the same error?

[andres-perez (Andrés Pérez)]

Can you set a longer throttle_period?
I see it set to 30 minutes in your example, maybe a bigger value would be enough.

I think it's the most suitable mechanism for handling duplicate notifications.
Maybe we can suggest to the elastic devs to implement some kind of "forever" value for that parameter

If that were not possible, what comes to my mind would be much more cumbersome:

• Add another search (so chain inputs) to obtain the results of the last execution (e.g. sort a small time range) recorded in the .watcher-history-... index each time the watcher is triggered.
• Add comparison logic (so probably a script comparison) to take that values into account.

You can find related information in this question:

Alert when okay

Hi @acchaulk, Watcher can absolutely do this because it is just a matter of defining a condition to trigger on. If the condition passes, such as when an "error" state is detected, then you can follow up by performing any action that is supported by Watcher. Therefore, the issue that you may be having is how to define the right condition and there are a lot of different strategies that you can employ, depending on the complexity that you are willing to endure: Create two Watches The first W…